Official source: PHP security releases
PHP published emergency security updates on 21 October for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. The issues could allow an unauthenticated attacker to run malicious code on a vulnerable server. PHP describes updating as the only safe choice.
PHP runs behind many websites and applications, often without the business owner ever needing to interact with it directly. That is why an issue like this can be worrying: a site may look normal to its customers while its underlying server software still needs urgent attention.
When a critical server update is needed, the useful outcome is not a technical explanation. It is a website that remains protected and available to the people who rely on it.
What happened
The PHP security team released fixed versions for the currently supported PHP branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The two vulnerabilities were rated 9.2 under CVSS v4.0 and could permit remote code execution without an attacker first signing in.
Security bodies including ENISA advised organisations to identify PHP-based applications, prioritise internet-facing systems and apply the released updates. That includes sites which use PHP through WordPress, ecommerce software, customer portals or other server-side tools.
What it meant for people using a website
For most customers, the risk was not a visible change to the website. The concern was what an attacker might be able to do if a vulnerable server was left unpatched: interfere with a website, gain access to data or disrupt the online services a business depends on.
That is why the response needs to happen behind the scenes. Updating the relevant PHP environment promptly reduces the exposure before it becomes a customer-facing problem, while normal checks make sure enquiries, payments, bookings and account routes continue to work as expected.
Our response for Jenlu customers
For customers covered by Jenlu support and hosting provisions, we immediately applied the relevant fixes and prioritised the affected environments. The aim was to reduce exposure quickly while keeping the websites and services people rely on available.
Not every website uses the same software, hosting arrangement or PHP version, so the appropriate action can differ. Where a site is outside an active support or hosting provision, the sensible next step is to confirm the PHP version and update route with the hosting provider or the team responsible for the website.
Need help checking your website? Jenlu provides practical support for hosting coordination, WordPress updates and urgent website security work, with a focus on the customer journeys your business needs to keep running.